JP2018160041A - Built-in device and control method and control program of built-in device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a built-in device, a control method and a control program of a built-in device, which are capable of updating a security function of firmware without influencing an operation of a built-in device.SOLUTION: A built-in device having a security function comprises a main body control unit controlling the built-in device, a security function unit realizing a security function, and a management unit managing the security function unit. In addition, the main body control unit, the security function unit, and the management unit are installed independently of each other.SELECTED DRAWING: Figure 6

Description

  The present invention relates to an embedded apparatus having a security function, an embedded apparatus control method, and a control program.

  In recent years, it has become common to be able to operate firmware of embedded devices via a network, and the importance of security has increased. As a result, new vulnerabilities in the implementation of existing security technologies represented by OpenSSL are discovered and fixed several times a year, and the frequency of updating the firmware of embedded devices that use them increases. ing.

  As related techniques, for example, Patent Document 1 and Patent Document 2 describe a firmware update method.

JP 2011-141696 A Japanese Patent Laying-Open No. 2015-108864

  Conventionally, a security mechanism for an external network in firmware of an embedded device is realized by linking a security library 402 to a module (for example, a Web server unit 401) that communicates with the outside as shown in FIG. In such a configuration, in order to update the security function, it is necessary to update not only the security library 402 but also the module main body, and replace it with one recompiled by referring to the header file of the security library 402.

  Although there are a plurality of such modules, the embedded firmware generally does not introduce a package management system due to storage capacity limitations. Therefore, even when it is desired to update only the security function, the entire firmware 400 needs to be updated. Further, the embedded device 500 needs to be restarted due to the update of the main body control unit 403.

  Many users determine that updating the main body control unit 403 during operation of the embedded device is risky. For this reason, there is a case where the security risk is increased by deferring the update and not updating it for the reason that the update is performed only at the regular maintenance time or the update is not performed if there is no problem in the control.

  The devices described in Patent Documents 1 and 2 have the above-mentioned problems because the security modules are not provided independently.

  Therefore, an object of the present invention is to provide an embedded device, a control method for the embedded device, and a control program that can update the security function of the firmware without affecting the operation of the embedded device.

  An embedded device according to the present invention is an embedded device having a security function, and includes a main body control unit that controls the embedded device, a security function unit that realizes the security function, and a management unit that manages the security function unit. The main body control unit, the security function unit, and the management unit are provided independently of each other.

  An embedded device control method according to the present invention is a method for controlling an embedded device having a security function, in which a management unit realizes a security function provided independently of a main body control unit that controls the embedded device. After the security function unit is stopped, the security function unit is updated, and the updated security function unit is activated.

  A control program according to the present invention is a control program applied to a computer having a security function, and a security function unit that implements a security function provided in the computer independently of a main body control unit that controls the computer And a process for updating the security function part and a process for starting the updated security function part.

  According to the present invention, the security function of the firmware can be updated without affecting the operation of the embedded device.

It is a block diagram which shows an example of a structure of the embedded apparatus by this invention. It is a flowchart which shows an example of the starting process of firmware. It is a flowchart which shows an example of the control processing of the embedded apparatus from the outside. It is a flowchart which shows an example of the update process of a security module. It is a block diagram which shows the structural example of a general embedded apparatus. It is a block diagram which shows the minimum structural example of an embedded apparatus.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing an example of the configuration of an embedded device according to the present invention. As shown in FIG. 1, in this embodiment, the firmware 101 of the embedded device 300 includes a Web server unit 102, a main body control unit 103, a security module 104, and an update UI (user interface) unit 105. It is configured to be able to operate independently. For example, in a storage unit such as a nonvolatile memory, the programs are stored in different storage areas as independent programs. Hereinafter, the expression that the Web server unit 102, the main body control unit 103, the security module 104, and the update UI (user interface) unit 105 operate will be used. Specifically, a single or a plurality of microprocessors, etc. An embedded CPU (Central Processing Unit) is realized by executing processing according to a program stored in a storage unit (not shown) such as a single or a plurality of nonvolatile memories.

  The security module 104 has a function as an interface with the console 200 installed outside the embedded device 300. That is, the security module 104 has a function of transmitting / receiving information to / from the console 200 installed outside the embedded device 300 via a communication network such as the Internet. The security module 104 is implemented as, for example, a proxy server that mediates between an external network and an internal module (or a tunneling service such as stunnnel).

  The security module 104 connects to either the Web server unit 102 or the update UI unit 105 according to the address specified by the information input from the console 200 via the communication network (that is, the connection destination is switched). It has a function. The security module 104 also has a function of decrypting ciphertext input from the console 200 via a communication network into plaintext.

  The Web server unit 102 has a function of outputting an instruction for controlling the embedded device 300 to the main body control unit 103 in accordance with information input from the console 200 via the communication network and the security module 104, and the main body control unit 103. A function of acquiring information related to the embedded device 300 via the.

  The main body control unit 103 has a function of acquiring information related to the embedded device 300 and a function of controlling operations of the embedded device 300.

  The update UI unit 105 stores a program for realizing the security module 104 in a storage unit (not shown) in accordance with information input from the console 200 via the communication network and the security module 104. A function of updating a storage area (that is, updating a program) and a function of starting and stopping the security module 104 independently of the Web server unit 102 and the main body control unit 103 are provided.

  Next, the operation of the embedded device will be described.

  FIG. 2 is a flowchart illustrating an example of a firmware activation process. When the power of the embedded device 300 shown in FIG. 1 is turned on, as shown in FIG. 2, the activation processing is executed in the order of the main body control unit 103 of the firmware 101, the Web server unit 102, the update UI unit 105, and the security module 104. (Steps S11 to S14).

  FIG. 3 is a flowchart illustrating an example of control processing of the embedded device from the outside. After the firmware 101 is activated, the control of the embedded device 300 from the console 200 installed outside is executed in the order shown in FIG.

  Specifically, when performing predetermined control in the embedded device 300, the user performs an input operation corresponding to the predetermined control using the console 200 provided outside the embedded device 300. Then, the console 200 designates an address for specifying the Web server unit 102 via the communication network, and transmits the main body control instruction information to the security module 104 (step S21).

  Next, the security module 104 decrypts the main body control instruction information received from the console 200 and outputs it to the Web server unit 102 (step S22).

  Next, the Web server unit 102 inputs the main body control instruction information output from the security module 104 (step S23). Through the processing in steps S21 to S23, the Web server unit 102 acquires the main body control instruction information transmitted from the console 200.

  Next, the Web server unit 102 outputs main body control instruction information to the main body control unit 103 (step S24).

  Next, the main body control unit 103 inputs the main body control instruction information output from the Web server unit 102, and controls the embedded device 300 according to the main body control instruction information (step S25). For example, the main body control unit 103 operates the embedded device 300 or acquires information related to the embedded device 300 according to the main body control instruction information.

  With the processing as shown in FIG. 3, the main body control instruction information by the ciphertext transmitted from the console 200 installed outside the embedded device 300 is decrypted into plaintext inside the firmware 101. Then, the embedded device 300 is controlled in accordance with the main body control instruction information.

  FIG. 4 is a flowchart illustrating an example of security module update processing. Updating of security functions for dealing with security vulnerabilities and the like is performed in the order shown in FIG. 4, and only the security module 104 is updated.

  Specifically, when the security function of the embedded device 300 is updated, the user performs an input operation for updating the security function using the console 200 provided outside the embedded device 300. Then, the console 200 designates an address for specifying the update UI unit 105 via the communication network and transmits the update information (for example, including the update program) encrypted to the security module 104. (Step S31).

  The security module 104 decrypts the update information received from the console 200 and outputs it to the update UI unit 105. Then, the update UI unit 105 acquires the update information transmitted from the console 200 (step S32).

  Next, the update UI unit 105 performs a process of stopping the operation of the security module 104 (step S33).

  Next, based on the update information, the update UI unit 105 updates the storage area in which the program for realizing the security module 104 is stored in the storage unit (step S34). That is, the update program is stored in a storage area in which a program for realizing the security module 104 is stored. In other words, the update UI unit 105 rewrites the contents of the storage area in which the program for realizing the security module 104 is stored.

  Next, the update UI unit 105 activates the security module 104 based on the updated program (step S35).

  In this embodiment, the security module 104 is provided independently of the Web server unit 102, the main body control unit 103, and the update UI unit 105. That is, they are stored in different storage areas as independently operable programs. For example, the Web server unit 102 operates according to a Web server unit program for realizing a Web server function, and the main body control unit 103 operates according to a main unit control unit program for controlling the embedded device 300. The module 104 operates according to a security module program for realizing a security function, and the update UI unit 105 operates according to an update UI unit program for realizing a security module update function. The Web server program, the main body control program, the security program, and the update UI program are stored in different storage areas. Therefore, the security module 104 can be stopped, updated, and started by the processes in steps S33 to S35 while the web server unit 102, the main body control unit 103, and the update UI unit 105 are operated.

  In this embodiment, when normal control is performed in the embedded device 300, an address for specifying the Web server unit 102 is specified as shown in step S21 of FIG. 3, but the security function is updated. In this case, as shown in step S31 of FIG. 4, an address for specifying the update UI unit 105 is designated. Therefore, it is recognized as different firmware for the user.

  In this way, the security function can be updated independently of the control of the embedded device 300, and at the same time, it can be seen from the outside as another independent firmware.

  As described above, the embedded device according to the present invention does not incorporate the security function unit into the module, but as a separate security module 104 as shown in FIG. In addition, an independent update UI unit 105 is added to update the security module 104 so that the update operation can be performed separately from the whole firmware.

  Therefore, the embedded device according to the present invention facilitates the security function during operation of the entire device by making the security function and the update function of the function independent of other functions in the security mechanism of the external network of the embedded firmware. Can be made updatable.

  Next, the minimum configuration of the embedded device according to the present invention will be described. FIG. 6 is a block diagram illustrating a minimum configuration example of the embedded device. As shown in FIG. 6, the embedded device 1 includes a main body control unit 2, a security function unit 3, and a management unit 4 as minimum components.

  6, the main body control unit 2 controls the embedded device, the security function unit realizes a security function, and the management unit 4 manages the security function unit 3. The main body control unit 2, the security function unit 3, and the management unit 4 are provided independently of each other.

  Therefore, according to the embedded device having the minimum configuration, the security function can be updated without affecting the operation of the embedded device.

  In the present embodiment, a characteristic configuration of an embedded device as shown in the following (1) to (5) is shown.

  (1) An embedded device having a security function (for example, the embedded device 300), which is realized by a main body control unit (for example, the main body control unit 103) that controls the embedded device, acquires information about the embedded device 300, And a security function unit that realizes a security function (for example, a function of decrypting a ciphertext input from the console 200 or switching a connection destination according to the input content). (For example, realized by the security module 104) and a management unit (for example, realized by the update UI unit 105) for managing the security function unit, the main body control unit, the security function unit, and the management unit are Provided independently of each other (for example, in a storage unit such as a nonvolatile memory, Stored in the different storage area as independently operable program are. See FIG. 1), characterized in.

  (2) In the embedded device, the main body control unit, the security function unit, and the management unit can operate independently from each other, and the management unit updates and updates the security function unit after stopping the security function unit Control for starting the security function unit can be performed (see FIG. 4), and the main body control unit may be configured to be operable even when the security function unit is stopped.

  (3) In the embedded device, the main body control unit operates according to a main body control program (for example, a program for the main body control unit) for controlling the embedded device, and the security function unit is a security program for realizing the security function. It may be configured to include a storage unit that operates according to (for example, a security module program) and stores the security program and the main body control program in different storage areas.

  (4) In the embedded device, when the security function unit is updated, the management unit may be configured to update only the storage area in which the security program is stored in the storage area of the storage unit.

  (5) In the embedded device, the security function unit sends the connection destination to the main body control unit (for example, the main body control unit 103 via the Web server unit 102) in accordance with an input (for example, a specified address) from outside the embedded device. It may be configured to switch to one of the connection unit and the management unit (see FIGS. 3 and 4).

  The present invention can be suitably applied to an embedded device having a network security mechanism, in particular, an apparatus used in a field where it is important not to stop operation, such as an enterprise server.

DESCRIPTION OF SYMBOLS 1 Embedded apparatus 2 Main body control part 3 Security function part 4 Management part 101 Firmware 102 Web server part 103 Main body control part 104 Security module 105 UI part for update 200 Console 300 Embedded apparatus

Claims (7)

An embedded device having a security function,
A main body control unit for controlling the embedded device;
A security function unit for realizing the security function;
A management unit for managing the security function unit;
The main body control unit, the security function unit, and the management unit are provided independently of each other. The main body control unit, security function unit and management unit can operate independently of each other,
The management unit, after stopping the security function unit, can update the security function unit and perform control to start the updated security function unit,
The embedded device according to claim 1, wherein the main body control unit is operable even when the security function unit is stopped. The main body control unit operates according to a main body control program for controlling the embedded device,
The security function section operates according to the security program for realizing the security function,
The embedded device according to claim 1, further comprising a storage unit that stores the security program and the main body control program in different storage areas. The embedded device according to claim 3, wherein when the security function unit is updated, the management unit updates only a storage area in the storage unit in which the security program is stored. The embedded device according to any one of claims 1 to 4, wherein the security function unit switches a connection destination to either the main body control unit or the management unit in accordance with an input from outside the embedded device. A method for controlling an embedded device having a security function,
The management unit updates the security function unit after stopping the security function unit that realizes the security function provided independently of the main body control unit that controls the embedded device, and the updated security function A method for controlling an embedded device, characterized by starting a part. A control program applied to a computer having a security function,
On the computer,
A process of stopping the security function unit that realizes the security function provided independently of the main body control unit that controls the computer;
Processing to update the security function unit;
A control program for executing a process for starting up the updated security function unit.

Images